gh0strat | b52e43cae2b2229b714c25eebe53439f031154fb7718fc3d0a11c0ff7eedad7f

Sharing

Copy URL Twitter E-mail

General

Target
b52e43cae2b2229b714c25eebe53439f031154fb7718fc3d0a11c0ff7eedad7f
Size 2.1MB
Sample261107-x6hmvs1vav
SHA256 b52e43cae2b2229b714c25eebe53439f031154fb7718fc3d0a11c0ff7eedad7f
MD5 22f5aa75eace1f265249a7e8c4dd939e
SHA1 92d68cf61f1484de38123e183869f6c6d4de2d02
SHA512 829e5b565ba18106cd4cddabe6888d42f21318365433cc20c706a88af68c4a35e798a31f0522165a04caae5d1c47b75a60404497fdb82419fa0e9191b98225d3
SSDEEP 49152:Iab21tGDmsjW+sRiLfo77TwrFqjmSzNVb946uiNH6W8v8zrzdsLxmh8:JEsR6+sRiLfo7XwrFqqS79j8KhsMh8
TLSH
T199A533A2401383DA721EA86C36545A66BB6A05198F3511336D9382407F47FF8E73ECFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  LinenMark/HTTPSAPI.dll
- Size 85KB
- SHA256 a66aaf885cb060dae61d392b43b03682537bf64a288aafcce13f43c0e6dbc5ae
- MD5 acba8257f030d8ae9887cddce8da435e
- SHA1 c9a875a0942e7b2b71437f1eed766bdab85618e5
- SHA512 38414582b1e6659dd3c5bf504cd41e5a37ec3096ee15d0388373441226a10093f9c0565c323a50a674f4f0b4039f14dcfdf36a38f05d027982dd68635baf07a6
- SSDEEP 1536:oD1qnFg4gNd4OT4PdXoLY4TRi1A6SlfHZ0xTHXsWR0cd7Hewl60TzW:oDuFVwZEPaLY4TA+HuRt7Hewl60G
- TLSH
  T10C837D1076D1D071E9BF19391864CAA15B3EBA20DEE0DDAB3B5502AD0F302C1DE35E7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  LinenMark/HTTPSAPI.dll.orig
- Size 1.8MB
- SHA256 a348adeb484ecd9c4655b671e47869949d72efe13980e096a3fc006dd47709cd
- MD5 2e0775c7c4dcc0e90186f429d1858e54
- SHA1 a9330ab7dd88ab8a1eb14060237fa6dd0e675db6
- SHA512 03d3c6171fe5af9545e2aba1c33fb1114d16426e90ac17fba00f449f546bb30be8e32b64b7438d9ea0d85d8bb972fb98e80216f9cab20ed3bf6d340ba89badec
- SSDEEP 49152:M6a4DoSlA5X3W94x/WpX/4aP3gAvY96N+s+:M6a4D9lA5ns4x/WpXgR
- TLSH
  T10C85AD13FF8188B2E9DF817491B7477B8D3A9624532885D396E138A9CD613E1373E389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  LinenMark/LinenMark.exe
- Size 806KB
- SHA256 71b5351c37ee5765dd68c4ac2ae3aa9f0bb3037f8673fe83b654f041eb58926f
- MD5 40fdd2b04593e97297bfe00a5b4454d2
- SHA1 184c9d1b65046a0e05d9bc03da922d022abedbc2
- SHA512 c3aeb585c4cf4bb164ef99f6ad9348a28557840f3c70d478766a3eb46cca901df7c05b6548ed9d3cb2dc9ffed4b6fd34d27954ceab725b081ce58669ab6aac9f
- SSDEEP 24576:tdK9xT6Cw7YBB3rCKrxhN/hdm6Q2dqQYTJc:29d6Cw7YBB3rCKrrNm6LYTJc
- TLSH
  T19F05391239C8BCB2C5722271577BA3E5876DFC600B64C6DF53C806699A7C5C33A317AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  LinenMark/Log.dll
- Size 238KB
- SHA256 d8f84c7b44e47153c092bbf08b30810c65da9ec5d017d36eda60580bc4688b91
- MD5 659364b75099a13367d28fce123a96f8
- SHA1 65e92cf386aa45ef324ccf75b0fae7249d0a3355
- SHA512 9ff87ac8f70f198d252f43099e6359652ee24be244fcdbec941d2c53a59bbb5dc886c53c727e78ffa214f445b7c0e0377d11e08ddc60f25e8e7769a07c5206d6
- SSDEEP 3072:UXgSsGXFsdeOWWljvGiGR5fxqD+7XPfwG1Qb1xh6ji1SAg0Fuj5QBQZzLAyHjyjG:Og9AQeOWWlunRrPfohSAOde4zLAyHLrb
- TLSH
  T11C349E117881C432D4BE293455799762597DB8200BA0CAEFA7F84E3D4F742C1A736BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Gh0strat

Gh0st RAT payload

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8